CRITICAL 9.0
GHSA-w22p-4x9f-486v
Jenkins GitHub Plugin has an XSS vulnerability
Quick fix
GHSA-w22p-4x9f-486v — com.coravy.hudson.plugins.github:github: upgrade to the fixed version with the command below.
# pom.xml: bump <version>1.46.0.1</version> for com.coravy.hudson.plugins.github:githubDetails
In Jenkins GitHub Plugin versions 1.46.0 and earlier, the JavaScript that validates the "GitHub hook trigger for GITScm polling" feature improperly processes the current job URL.
This results in a stored cross-site scripting (XSS) vulnerability exploitable by non-anonymous attackers with Overall/Read permission.
GitHub Plugin 1.46.0.1 no longer processes the current job URL as part of JavaScript implementing validation of the feature "GitHub hook trigger for GITScm polling".
Are you affected?
Enter the version of the package you're using.
Affected packages
Maven / com.coravy.hudson.plugins.github:github
Introduced in:
0 Fixed in: 1.46.0.1 Fix
# pom.xml: bump <version>1.46.0.1</version> for com.coravy.hudson.plugins.github:github